Description

2017 New Year's resolution to participate more actively in VIC...

TL;DR summary: highly profitable software business levered to cloud, cybersecurity trends trading at 10x 2018E NOPAT with CEO who owns > 15% of company. $50-55 target on $33 stock with some margin of safety through absolute valuation and debt-free balance sheet with $7+ in net cash/share.

Qualys is a rare bird as a cybersecurity business with rapid growth and good profitability. The Vulnerability Management space is a security niche growing low double digits with leverage to the cloud and the ever-growing threat environment. Layering on new products brings Qualys to an 20%+ revenue CAGR and some leverage to its current ~35% EBITDA margins. We think QLYS trades at a reasonable 12-13x P/FCF on our 2018 estimates or 12x EV/EBITDA excluding SBC. As CEO Philippe Courtot directly owns $180m in stock at today's prices and another $60m in option value, he acts in the best interests of shareholders because he is the largest one. Theoretically attractive to a larger security platform or financial sponsor, QLYS should trade to $50-55 over a 12-24 month time horizon.

Why does the opportunity exist?

Pick up any sell-side note on QLYS or this space and it will compare peers on an EV/Sales basis. Some companies are investing for rapid growth, some are profitable and some may be selling dimes for five cents apiece. Some companies are selling hardware appliances, some are selling software subscriptions, etc. To make an apples/apples comparison, the street is forced to the worst place...the top of the income statement. We question why EV/Sales would ever be the right frame for any business, much less one that could do upwards of $2.75-3/share in 2018 FCF. 

Business Description

Qualys provides cloud-based security and compliance solutions. Its platform allows customers to detect critical weaknesses and potential threats in their IT environment. Customers can identify IT assets, analyze data about risks and take proactive steps to protect the network. Recurring revenue is ~95% of total revenue with sales occurring 60% direct and 40% through resellers/channel. Main services include continuous perimeter scanning, policy compliance scanning and web application security. Roughly 70% of the business is US-based with ~80% of the next period's business ‘known’ given deferred revenue on the balance sheet.

Key Points

 Vulnerability management growing TAM - with ~10% share in the $6bn VM market, QLYS is growing revenue 20%% y/y in a TAM that IDC estimates will grow at a 15% CAGR. This market is growing due to (1) security threats rising, (2) transition to cloud-based architectures and (3) increased entropy of compliance even in a Trump administration (think PCI, HIPAA, more which don't really 'go away'). Core VM or the tracking of IT assets and agents is taking on increased importance with the advent of cloud-based environments and rising compliance requirements. Knowing what assets are more susceptible to attacks through the QualysGuard platform pairs well with analytics and areas for new product development like Web Application Firewall (WAF), patch management and more.

 Cloud-based services growing rapidly – with a true cloud platform that consolidates 10+ on-premise solutions, QLYS scans over 1 trillion security data points annually. The Cloud Agent platform leads to stronger scanning and analytics. With 60% of the top 100 enterprises globally but 24% of the top 2,000 enterprises there is room for penetration as these services become even more affordable and relevant to small/medium-sized customers. Importantly, this means the company does not lose high-margin hardware/appliance business to sign up software subscriptions. 

 CEO owns a big chunk of stock, allocates capital well – CEO Philippe Courtot has been CEO of Qualys since 2001, leading its growth from private company to a 2012 IPO. He is technically proficient and owned ~40% of the business prior to IPO. Today, his stake includes $180m in directly owned stock or ~15% of the company and another $60m in options value at today’s prices. This should ensure that the CEO acts in the best interest of shareholders. The CEO shows no signs of slowing down, but at age 72 could look to monetize his stake at some point.

 Decent backdrop for cybersecurity – QLYS bookings growth of > 20% in 2016 should be sustainably high given high compliance and regulatory burdens for customers and a proactive approach to analytics as opposed to the old way of protecting the castle walls. As spend shifts away from legacy endpoint security and towards the cloud, Qualys is poised to gain wallet share. Headlines about hacks and cyber attacks don't drive immediate growth, but are part of the industry mosaic.

 Takeout potential given recurring revenue – with 95% of revenue deemed recurring in highly predictable model, deals in the software space in recent history have occurred at 4-10x maintenance revenue. With this frame, QLYS on $225m in CY17 recurring revenue would be a $30-65 stock compared to today’s $33. With $7/share in net cash, QLYS could be a good match for larger peers in VM like IBM, HP, EMC or analytics peers like SPLK. While it might be far-fetched to suggest a financial sponsor could get excited about improving upon industry-leading margins, the LBO math conceptually works.

Key Risks

 While we think FCF provides some ballast to valuation, the market ignored cash flow in 1Q16 when QLYS traded to $17/share which equates to 2.0x EV/Sales or < 12x P/FCF ($20 downside on CY17 consensus)

 Execution on sales, costs and international growth. This is a competitive market with Competitive market with RPD and Tenable potentially upsetting the apple cart on pricing in a weaker environment.

Freeform Q&A

Rather than rehash the business description from the 10-K or a sell-side initiation, an informal Q&A below might point the reader in the right direction on QLYS.

Won't this idea not work if bookings growth slows? Isn't this a competitive space?

To some extent, sure. The main peers in a highly fragmented VM market include Rapid7 (RPD) and the privately-held Tenable. A few years ago price competition was more of a feature in the space as the then-private companies scrapped for market share. Since then, we think each competitor has focused on different areas for growth with Qualys looking to its Cloud Agent, WAF and other areas while RPD seems to be going the analytics route and Incident Detection & Response (what do we do once the bad guys get in?). 

While billings growth obviously matters, a high rate of customer retention in the mid-90s becomes a dollar revenue renewal rate in the 105-110% range based on growth in customer IP addresses. This provides strong revenue visibility going into any given period.

In a slower spending environment, VM is still an important pocket of spending for compliance-related reasons. But on the margin maybe this gets trimmed more than a Palo Alto next-gen firewall.

M&A upside is a pipe dream if there are more motivated sellers that come first?

Yep, probably true. There are two large VC holders still active in RPD (Bain and TCV) while Tenable is still private (Accel and Inisght Venture Partners). It is fine that there is good cash flow here but if anyone is going to go first, maybe it should be the other guys. With the VCs still in RPD, perhaps they aren't ready to plop a secondary on the market at a valuation they'd deem too low. To reiterate, it also doesn't seem highly likely that a PE sponsor would think they could take margins from 35% to 40-45% even as incremental EBIT margins have been robust.

Aren't fat margins just there to be 'disrupted' or competed away?

We think there are clear reasons that QLYS has sustainably high margins. Its code base is built on one platform that allows it to launch and monitor products both in the cloud and on-prem in a simple fashion. A focus on larger enterprise customers has led to superior margins to public peer RPD which has grown more through acquisition and is moving up the stack from SME customers to larger. 

Come on, $30-40m in annual R&D isn't enough to protect those margins?

We don't assume QLYS sees much operating leverage on this line, but the common code base referenced above has been one clear reason it has developed additional services and products at a favorable cost. To continue growing near 20% top-line, they need to invest a healthy amount for growth.

Walk me from GAAP to non-GAAP EPS?

Just SBC, really. It has been running ~$20m per year on an adjusted EBITDA figure we expect to be > $100m in 2018E. It might be come in fits and starts, but maybe the street moves toward an EBITDA definition that excludes the SBC add-back. That said, over the past three years if the share count finishes 2016 near 38.8m, QLYS will have seen 1.9% dilution per year and no cash spent on buybacks. We find earnings quality to be solid, though respect that if an investor frames the opportunity as cash flow-oriented, then adjusted EPS or EBITDA metrics might not be the best valuation construct.

Did the market like the prior CFO (2006 - 1Q16)?

Don McCauley did a good job navigating QLYS's growth as a private company through IPO. He did a fine job and hasn't resurfaced in a new role, but resigned Jan 2016. In his late 60s, it may/may not be considered retirement. The new CFO Melissa Fisher has a background in TMT banking. Given the predictability of the model and clear communication, we think the risk of major hiccups from the CFO suite is low.

Make a case for permanent destruction of capital.

Slower bookings and the need for future 'investment years' lead to lower margins and cash flow. Peers may get desperate and push on price (though this is a sticky product with little horse trading). At $1.50-2 in FCF and $10 in net cash on the balance sheet, one could make a hard downside case for the high $20s by sometime in 2018. We don't think this is likely but admit there's no hard asset value in a software biz if you seek downside protection.

Catalyst

Bookings growth coupled with new products leads to higher street estimates for 2017-18

Potential multiple expansion on FCF and EBITDA CAGR of 20%+ next 2-3 years. Maybe street wakes up to FCF or EBITDA-based valuation instead of EV/Sales

Company should finish 2017 with > $10/share in net cash and can deploy it through tuck-in M&A or buybacks

Maybe an acquisition target, but not necessary to get paid